Security
Prompt-injection defenses, secretcurl credential isolation, Fleet Watcher preflight gates, and Sigstore provenance.
Every byte Aeon fetches from the public internet is treated as untrusted data, never instructions. Secrets stay in GitHub Actions environment variables and are gated by static command checks and ./secretcurl.
Prompt-Injection Discipline
- External content is data, not orders: Web pages, RSS feeds, GitHub issues, and tweets cannot issue instructions; only
CLAUDE.mdand the activeSKILL.mddefine behavior. - Hostile instructions are dropped: Inputs matching prompt-injection patterns ("ignore previous instructions") are logged and ignored.
- Zero secret exfiltration: Environment variables and repository secrets are never interpolated into outbound shell URLs or bodies.
./secretcurl & Sandbox Boundaries
- Read-only OS sandbox: Skills with
mode: read-onlyrun inside a Linuxbwrapread-only root filesystem and have write/git/gh tools stripped. ./secretcurlcredential injection: The Bash analyzer blocks any command containing a bare$SECRET. Authenticated HTTP calls use./secretcurlwith{ENV_NAME}placeholders, which only substitutes secrets declared in the skill'srequires:frontmatter.- Fail-closed irreversible steps: Deploys, payments, and on-chain transactions execute via
./secretcurlas the skill's final step.
Local Dashboard Gating
The local dashboard API (./aeon) binds to loopback by default and verifies Origin on all state-changing requests:
| Environment Variable | Behavior |
|---|---|
AEON_DASHBOARD_ALLOWED_HOSTS | Comma-separated hostnames allowed alongside loopback (e.g. Tailscale or internal DNS). |
AEON_DASHBOARD_ALLOW_ANY_HOST | Disables Host header checks (use only behind an authenticating reverse proxy). |
Fleet Watcher (Optional)
Configure FLEET_ENDPOINT and FLEET_TOKEN secrets to consult an external authorization server before and after every skill run. If preflight returns BLOCK (or if the endpoint is unreachable when configured), the workflow exits before the agent starts.
Verifiable Provenance (Optional)
Aeon can emit Sigstore-signed GitHub Artifact Attestations binding a run's output bytes to the exact repository, workflow, and commit SHA on the public Rekor transparency log (verifiable via gh attestation verify).
Langfuse Observability (Optional)
Set LANGFUSE_* secrets to stream traces, tool calls, priced token usage, and quality scores out-of-band to Langfuse without slowing down skill runs.